Azure Private Link & Endpoint

Core Functionality

• Private Endpoint: A private IP address within your virtual network that acts as an entry point to access an Azure service. Ensures that traffic remains within the Microsoft backbone network.
• Secure Connectivity: Eliminates exposure to the public internet by enabling private access to services such as Azure Storage, SQL Database, and Cosmos DB.
• Integration with Azure Services: Supports multiple Azure services, allowing secure and private connectivity to PaaS and SaaS offerings.
• Simplified Network Architecture: Reduces complexity by providing private access without the need for a virtual network peering or VPN gateway.
• Compliance and Security: Helps meet compliance requirements by providing a secure and isolated connection to Azure services.

Difference Between Azure Private Link and Azure Private Endpoint

• Azure Private Link: Enables private connectivity to services without exposing them to the public internet.
• Azure Private Endpoint: A network interface within your virtual network that connects privately and securely to a service powered by Azure Private Link.

Private Link and IP Address

• Private Link: Does not directly assign an IP address to the resource.
• Private Endpoint: Provides the resource with a private IP address within your virtual network.

Using Private Link without Private Endpoint

• You cannot use Azure Private Link without a Private Endpoint. The Private Endpoint is essential for creating the private connection.

Trace Packet Explanation

• A trace packet scenario involves a client request being directed to a Private Endpoint, NAT’d to the Microsoft backbone, received by the service provider, and the response returning through the same path.

Example Azure resource networking options

• Enable from All Networks: Broad accessibility, less secure.
• Public and VNet: Controlled access from specific VNets and the public internet, does not use a Private Endpoint.
• Disable Public and Use Private: High security, private access only using a Private Endpoint.

Addressing Resources in Different Networking Options

• Public and VNet: Access the resource using its public DNS name or IP address, with network rules allowing specified VNets to connect.
• Disable Public and Use Private: Uses a Private Endpoint with a private IP address within your VNet, no public access.

Key Points on Networking Options

• Public: Uses a public IP address.
• Public and VNet: Keeps public IP but restricts access to specified VNets, does not use Private Endpoint.
• Disable Public and Use Private: Uses Private Endpoint with a private IP, no public access.

Pricing

Azure Private Link pricing is based on the number of private endpoints and the amount of data processed through them. Charges are incurred for the private endpoint itself and for the data transfer costs.

For detailed pricing information, refer to the Azure Private Link pricing page.

Resources

• Azure Private Link Overview
• Private Endpoint Overview
• Private Link Service Overview
• Azure Private Link Pricing